Changeset 287315 in webkit


Ignore:
Timestamp:
Dec 21, 2021 8:09:07 AM (7 months ago)
Author:
J Pascoe
Message:

[WebAuthn] Authenticator is not falling back to clientPIN after internal verification fails and is blocked.
​https://bugs.webkit.org/show_bug.cgi?id=232501
<rdar://problem/84913636>

Reviewed by Darin Adler.

Whenever internal uv gets blocked, the user agent should fall back to using a pin for user verification. This
Source/WebKit:

patch starts doing that by going into the pin flow whenever the authenticator returns the pin required error
code.

Added API test for fallback.

  • UIProcess/WebAuthentication/fido/CtapAuthenticator.cpp:

(WebKit::CtapAuthenticator::makeCredential):
(WebKit::CtapAuthenticator::getAssertion):
(WebKit::CtapAuthenticator::tryRestartPin):

Tools:

adds an API test to verify this behavior.

  • TestWebKitAPI/TestWebKitAPI.xcodeproj/project.pbxproj:
  • TestWebKitAPI/Tests/WebKitCocoa/_WKWebAuthenticationPanel.mm:

(TestWebKitAPI::TEST):

Location:
trunk
Files:
1 added
5 edited

Legend:

Unmodified
Added
Removed

  • trunk/Source/WebKit/ChangeLog

    r287313 r287315  
     12021-12-21  J Pascoe  <j_pascoe@apple.com>
     2
     3        [WebAuthn] Authenticator is not falling back to clientPIN after internal verification fails and is blocked.
     4        https://bugs.webkit.org/show_bug.cgi?id=232501
     5        <rdar://problem/84913636>
     6
     7        Reviewed by Darin Adler.
     8
     9        Whenever internal uv gets blocked, the user agent should fall back to using a pin for user verification. This
     10        patch starts doing that by going into the pin flow whenever the authenticator returns the pin required error
     11        code.
     12
     13        Added API test for fallback.
     14
     15        * UIProcess/WebAuthentication/fido/CtapAuthenticator.cpp:
     16        (WebKit::CtapAuthenticator::makeCredential):
     17        (WebKit::CtapAuthenticator::getAssertion):
     18        (WebKit::CtapAuthenticator::tryRestartPin):
     19
    1202021-12-21  Kimmo Kinnunen  <kkinnunen@apple.com>
    221

  • trunk/Source/WebKit/UIProcess/WebAuthentication/fido/CtapAuthenticator.cpp

    r284095 r287315  
    7474    case CtapDeviceResponseCode::kCtap2ErrPinInvalid:
    7575    case CtapDeviceResponseCode::kCtap2ErrPinBlocked:
     76    case CtapDeviceResponseCode::kCtap2ErrPinRequired:
    7677        return true;
    7778    default:
    … …  
    9798    auto internalUVAvailability = m_info.options().userVerificationAvailability();
    9899    // If UV is required, then either built-in uv or a pin will work.
    99     if (internalUVAvailability == UVAvailability::kSupportedAndConfigured && (!options.authenticatorSelection || options.authenticatorSelection->userVerification != UserVerificationRequirement::Discouraged))
     100    if (internalUVAvailability == UVAvailability::kSupportedAndConfigured && (!options.authenticatorSelection || options.authenticatorSelection->userVerification != UserVerificationRequirement::Discouraged) && m_pinAuth.isEmpty())
    100101        cborCmd = encodeMakeCredenitalRequestAsCBOR(requestData().hash, options, internalUVAvailability);
    101102    else if (m_info.options().clientPinAvailability() == AuthenticatorSupportedOptions::ClientPinAvailability::kSupportedAndPinSet)
    … …  
    142143    auto internalUVAvailability = m_info.options().userVerificationAvailability();
    143144    // If UV is required, then either built-in uv or a pin will work.
    144     if (internalUVAvailability == UVAvailability::kSupportedAndConfigured && options.userVerification != UserVerificationRequirement::Discouraged)
     145    if (internalUVAvailability == UVAvailability::kSupportedAndConfigured && options.userVerification != UserVerificationRequirement::Discouraged && m_pinAuth.isEmpty())
    145146        cborCmd = encodeGetAssertionRequestAsCBOR(requestData().hash, options, internalUVAvailability);
    146147    else if (m_info.options().clientPinAvailability() == AuthenticatorSupportedOptions::ClientPinAvailability::kSupportedAndPinSet && options.userVerification != UserVerificationRequirement::Discouraged)
    … …  
    344345    case CtapDeviceResponseCode::kCtap2ErrPinAuthInvalid:
    345346    case CtapDeviceResponseCode::kCtap2ErrPinInvalid:
     347    case CtapDeviceResponseCode::kCtap2ErrPinRequired:
    346348        getRetries();
    347349        return true;

  • trunk/Tools/ChangeLog

    r287310 r287315  
     12021-12-21  J Pascoe  <j_pascoe@apple.com>
     2
     3        [WebAuthn] Authenticator is not falling back to clientPIN after internal verification fails and is blocked.
     4        https://bugs.webkit.org/show_bug.cgi?id=232501
     5        <rdar://problem/84913636>
     6
     7        Reviewed by Darin Adler.
     8
     9        Whenever internal uv gets blocked, the user agent should fall back to using a pin for user verification. This
     10        adds an API test to verify this behavior.
     11
     12        * TestWebKitAPI/TestWebKitAPI.xcodeproj/project.pbxproj:
     13        * TestWebKitAPI/Tests/WebKitCocoa/_WKWebAuthenticationPanel.mm:
     14        (TestWebKitAPI::TEST):
     15
    1162021-12-21  Sam Weinig  <weinig@apple.com>
    217

  • trunk/Tools/TestWebKitAPI/TestWebKitAPI.xcodeproj/project.pbxproj

    r287223 r287315  
    299299                51EB126724CB8753000CB030 /* SunLightApplicationGenericNES.mm in Sources */ = {isa = PBXBuildFile; fileRef = 51EB126624CB8493000CB030 /* SunLightApplicationGenericNES.mm */; };
    300300                520BCF4C141EB09E00937EA8 /* WebArchive_Bundle.cpp in Sources */ = {isa = PBXBuildFile; fileRef = 520BCF4A141EB09E00937EA8 /* WebArchive_Bundle.cpp */; };
     301                521D1B7327713E80003900C5 /* web-authentication-get-assertion-hid-internal-uv-pin-fallback.html in Copy Resources */ = {isa = PBXBuildFile; fileRef = 521D1B7227713E80003900C5 /* web-authentication-get-assertion-hid-internal-uv-pin-fallback.html */; };
    301302                5245178721B9F57B0082CB34 /* RenderingProgressPlugIn.mm in Sources */ = {isa = PBXBuildFile; fileRef = 52D5D6BE21B9F1B20046ABA6 /* RenderingProgressPlugIn.mm */; };
    302303                524BBC9E19DF72C0002F1AF1 /* file-with-video.html in Copy Resources */ = {isa = PBXBuildFile; fileRef = 524BBC9B19DF3714002F1AF1 /* file-with-video.html */; };
    … …  
    15801581                                CD577799211CE0E4001B371E /* web-audio-only.html in Copy Resources */,
    15811582                                57663DF32357E48900E85E09 /* web-authentication-get-assertion-hid-cancel.html in Copy Resources */,
     1583                                521D1B7327713E80003900C5 /* web-authentication-get-assertion-hid-internal-uv-pin-fallback.html in Copy Resources */,
    15821584                                52C8C13A2706439000BDF3B7 /* web-authentication-get-assertion-hid-internal-uv.html in Copy Resources */,
    15831585                                579F1C0123C93AF500C7D4B4 /* web-authentication-get-assertion-hid-multiple-accounts.html in Copy Resources */,
    … …  
    20922094                520BCF4A141EB09E00937EA8 /* WebArchive_Bundle.cpp */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.cpp.cpp; path = WebArchive_Bundle.cpp; sourceTree = "<group>"; };
    20932095                520BCF4B141EB09E00937EA8 /* WebArchive.cpp */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.cpp.cpp; path = WebArchive.cpp; sourceTree = "<group>"; };
     2096                521D1B7227713E80003900C5 /* web-authentication-get-assertion-hid-internal-uv-pin-fallback.html */ = {isa = PBXFileReference; lastKnownFileType = text.html; name = "web-authentication-get-assertion-hid-internal-uv-pin-fallback.html"; path = "Tests/WebKitCocoa/web-authentication-get-assertion-hid-internal-uv-pin-fallback.html"; sourceTree = "<group>"; };
    20942097                524BBC9B19DF3714002F1AF1 /* file-with-video.html */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = text.html; path = "file-with-video.html"; sourceTree = "<group>"; };
    20952098                524BBC9C19DF377A002F1AF1 /* WKPageIsPlayingAudio.cpp */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.cpp.cpp; path = WKPageIsPlayingAudio.cpp; sourceTree = "<group>"; };
    … …  
    31653168                        isa = PBXGroup;
    31663169                        children = (
     3170                                521D1B7227713E80003900C5 /* web-authentication-get-assertion-hid-internal-uv-pin-fallback.html */,
    31673171                                52C8C1392706439000BDF3B7 /* web-authentication-get-assertion-hid-internal-uv.html */,
    31683172                                52C8C1372706437C00BDF3B7 /* web-authentication-make-credential-hid-internal-uv.html */,

  • trunk/Tools/TestWebKitAPI/Tests/WebKitCocoa/_WKWebAuthenticationPanel.mm

    r287278 r287315  
    12521252}
    12531253
     1254TEST(WebAuthenticationPanel, GetAssertionInternalUVPinFallback)
     1255{
     1256    reset();
     1257    RetainPtr<NSURL> testURL = [[NSBundle mainBundle] URLForResource:@"web-authentication-get-assertion-hid-internal-uv-pin-fallback" withExtension:@"html" subdirectory:@"TestWebKitAPI.resources"];
     1258
     1259    auto *configuration = [WKWebViewConfiguration _test_configurationWithTestPlugInClassName:@"WebProcessPlugInWithInternals" configureJSCForTesting:YES];
     1260    [[configuration preferences] _setEnabled:YES forExperimentalFeature:webAuthenticationExperimentalFeature()];
     1261    [[configuration preferences] _setEnabled:NO forExperimentalFeature:webAuthenticationModernExperimentalFeature()];
     1262
     1263    auto webView = adoptNS([[TestWKWebView alloc] initWithFrame:NSZeroRect configuration:configuration]);
     1264    auto delegate = adoptNS([[TestWebAuthenticationPanelUIDelegate alloc] init]);
     1265    [webView setUIDelegate:delegate.get()];
     1266    [webView focus];
     1267
     1268    webAuthenticationPanelPin = "1234";
     1269    [webView loadRequest:[NSURLRequest requestWithURL:testURL.get()]];
     1270    [webView waitForMessage:@"Succeeded!"];
     1271}
     1272
    12541273TEST(WebAuthenticationPanel, GetAssertionPinAuthBlockedError)
    12551274{
Note: See TracChangeset for help on using the changeset viewer.